How can Asset Intelligence improve cybersecurity?

CIOs are always looking for ways to improve network security. And according to a recent article by Louis Columbus in Forbes, they are “finding new ways to further improve network security by capitalizing on each IT assets’ intelligence.”

IT assets ideally need to capture real time data, as that is how organisations grow. CIOs and their teams, “are energized by the opportunity to create secured perimeterless networks that can flex in real-time as their businesses grow,” Columbus says, and “having a persistent connection to every device across an organizations’ constantly changing perimeter provides invaluable data for achieving this goal.”

What we are all aiming for is real-time, persistent connections to every device in a network, because that is the foundation of a strong endpoint security strategy. But how we achieve this?

1. Track lost or stolen devices within an organisation’s network and disable them.

2. Enable every endpoint to autonomously self-heal

3. Set the data foundation for achieving always-on persistence by tracking every devices’ unique attributes, identifiers, communication log history and more.

4. Have a real-time connection to every device on a perimeterless network.

5. Build more Asset Intelligence in an organisation, because the more they can predict and detect malware intrusion attempts, block them and restore any damage to any device on their perimeter.

6. Geofencing is a must-have for every organisation now, especially those with a global presence. IT and cybersecurity teams need to track device location, usage and compliance in real-time.

7. Automate customer and regulatory audits, as well as improve compliance by using Asset Intelligence. This will save time for the IT team.

8. Asset Intelligence creates cleaner data systems and this has a direct effect on the customer experience. As Columbus says, “Improving data hygiene is essential for IT to keep achieving their incentive plans and earning bonuses.”

The key thing to remember are ‘data hygiene’, because that is where the improvements to security are to be found. And the organisations that are most efficient at implementing this, will be the winners of pubic trust; a very important thing these days.

It’s nothing new: Cybercrime goes back to 19th century

Most of us think that cybercrime is an activity that goes back around 20 to 30 years. We think in terms of how long the Internet has been around. But that would be quite far from the truth. Since technology has been used as a form of communication, there have been individuals who have sought to use it for criminal activity.

The first ‘hack’ took place in 1834. In that year, some thieves hacked (not a word they used then) the French Telegraph system to steal financial market information. And in 1870, a young person was hired to operate a telephone switchboard in order to disconnect and redirect calls for personal use. This also happened in the early days of the New York telephones system, which started in 1878, when a group of teenagers were found to be intentionally misdirecting calls.

Fast forward to 1939, and we have what might be called a ‘good’ hack. This is when Alan Turing and his codebreaking team at Bletchley Park in the UK broke Germany’s Enigma codes. It was an important breakthrough in WW2, and there were some other intrepid technology hacks of this kind during the war.

In 1955 David Condon whistled his “Davy Crockett Cat” and “Canary Bird Call Flute” into his phone, testing a theory on how phone systems work. The system recognized the secret code, assumed he was an employee, and connected him to a long-distance operator. She then connected him to any phone number he requested for free.

In the 1960s there was the first example of a computer virus. Called the Rabbits Virus, it started when an anonymous person installed a programme on a computer at the University of Washington Computer Centre. The inconspicuous programme made copies of itself (breeding like a rabbit) until the computer overloaded and stopped working.

And in 1971, the founders of Apple, Steve Jobs and Steve Wozniak, discovered the joys of phone pranks. Wozniak, built a blue box designed to hack into phone systems, and pretended to be Henry Kissinger, as well as prank-calling the Pope. He started mass-producing the device with friend Steve Jobs and selling it to classmates.

But it isn’t until the beginning of the 1980s that the first cybercrime conviction happens. Ian Murphy, aka “Captain Zap,” hacked into the AT&T network and changed the internal clock to charge off-hour rates at peak times.

Since then, the cybercrime incidents have picked up speed, to include an array of viruses, such as the Melissa virus that infected Microsoft Word documents, and a host of DDoS attacks, and a global bank attack perpetrated by a group of Russian hackers to secure information from more than 100 institutions around the world. They stole £650 million.

And this year 74 Facebook groups devoted to the sale of stolen credit card data, identity info, spam lists, hacking tools, and other cybercrime commodities were uncovered.

Perhaps it is somewhat surprising that history is able to keep repeating itself with such ease. It does seem that cybersecurity has too often been something of an afterthought on the part of large organisations. There is no such thing as “perfect security”, because there will always be some hackers out there who are busy working out how to stay ahead of the security systems. The challenge for everyone is how to stay ahead of the hackers.

Take a read through the timeline below and give some thought to how innovation, information sharing, proactivity, diligence, and experience have transformed how we would have reacted in these situations if given the chance to tackle them again…

Dateline Cybercrime

1834 — French Telegraph System — A pair of thieves hack the French Telegraph System and steal financial market information, effectively conducting the world’s first cyberattack.

1870 — Switchboard Hack — A teenager hired as a switchboard operator is able to disconnect and redirect calls and use the line for personal usage.

1878 — Early Telephone Calls — Two years after Alexander Graham Bell invents the telephone, the Bell Telephone Company kicks a group of teenage boys off the telephone system in New York for repeatedly and intentionally misdirecting and disconnecting customer calls.

1903 — Wireless Telegraphy — During John Ambrose Fleming’s first public demonstration of Marconi’s “secure” wireless telegraphy technology, Nevil Maskelyne disrupts it by sending insulting Morse code messages discrediting the invention.

1939 — Military Codebreaking — Alan Turing and Gordon Welchman develop BOMBE, an electro-mechanical machine, during WWII while working as codebreakers at Bletchley Park. It helps to break the German Enigma codes.

1940 — First Ethical Hacker — Rene Carmille, a member of the Resistance in Nazi-occupied France and a punch-card computer expert who owns the machines that the Vichy government of France uses to process information, finds out that the Nazis are using punch-card machines to process and track down Jews, volunteers to let them use his, and then hacks them to thwart their plan.

1955 — Phone Hacker — David Condon whistles his “Davy Crockett Cat” and “Canary Bird Call Flute” into his phone, testing a theory on how phone systems work. The system recognizes the secret code, assumes he is an employee, and connects him to a long-distance operator. She connects him to any phone number he requests for free.

1957 — Joybubbles — Joe Engressia (Joybubbles), a blind, 7-year-old boy with perfect pitch, hears a high-pitched tone on a phone line and begins whistling along to it at a frequency of 2600Hz, enabling him to communicate with phone lines and become the U.S.’s first phone hacker or “phone phreak.”

1962 — Allan Scherr — MIT sets up the first computer passwords, for student privacy and time limits. Student Allan Scherr makes a punch card to trick the computer into printing off all passwords and uses them to log in as other people after his time runs out. He also shares passwords with his friends, leading to the first computer “troll.” They hack into their teacher’s account and leave messages making fun of him.

1969 — RABBITS Virus — An anonymous person installs a program on a computer at the University of Washington Computer Center. The inconspicuous program makes copies of itself (breeding like a rabbit) until the computer overloads and stops working. It is thought to be the first computer virus.

1970–1995 — Kevin Mitnick — Beginning in 1970, Kevin Mitnick penetrates some of the most highly-guarded networks in the world, including Nokia and Motorola, using elaborate social engineering schemes, tricking insiders into handing over codes and passwords, and using the codes to access internal computer systems. He becomes the most-wanted cybercriminal of the time.

1971 — Steve Wozniak and Steve Jobs — When Steve Wozniak reads an article about Joybubbles and other phone phreaks, he becomes acquainted with John “Captain Crunch” Draper and learns how to hack into phone systems. He builds a blue box designed to hack into phone systems, even pretending to be Henry Kissinger and prank-calling the Pope. He starts mass-producing the device with friend Steve Jobs and selling it to classmates.

1973 — Embezzlement — A teller at a local New York bank uses a computer to embezzle over $2 million dollars.

1981 — Cybercrime Conviction — Ian Murphy, aka “Captain Zap,” hacks into the AT&T network and changes the internal clock to charge off-hour rates at peak times. The first person convicted of a cybercrime, and the inspiration for the movie “Sneakers,” he does 1,000 hours of community service and 2.5 years of probation.

1982 — The Logic Bomb — The CIA blows up a Siberian Gas pipeline without the use of a bomb or a missile by inserting a code into the network and the computer system in control of the gas pipeline. The code was embedded into equipment purchased by the Soviet Union from a company in Canada.

1984 — US Secret Service — The U.S. Comprehensive Crime Control Act gives Secret Service jurisdiction over computer fraud.

1988 — The Morris Worm — Robert Morris creates what would be known as the first worm on the Internet. The worm is released from a computer at MIT to suggest that the creator is a student there. The potentially harmless exercise quickly became a vicious denial of service attack when a bug in the worm’s spreading mechanism leads to computers being infected and reinfected at a rate much faster than he anticipates.

1988–1991 — Kevin Poulsen — In 1988, an unpaid bill on a storage locker leads to the discovery of blank birth certificates, false IDs, and a photo of hacker Kevin Poulsen, aka “Dark Dante,” breaking into a telephone company trailer. The subject of a nationwide manhunt, he continues hacking, including rigging the phone lines of a Los Angeles radio station to guarantee he is the correct caller in a giveaway contest. He is captured in 1991.

1989 — Trojan Horse Software — A diskette claiming to be a database of AIDS information is mailed to thousands of AIDS researchers and subscribers to a UK computer magazine. It contains a Trojan (after the Trojan Horse of Greek mythology), or destructive program masquerading as a benign application.

1994 — Datastream Cowboy and Kuji — Administrators at the Rome Air Development Center, a U.S. Air Force research facility, discover a password “sniffer” has been installed onto their network, compromising more than 100 user accounts. Investigators determined that two hackers, known as Datastream Cowboy and Kuji, are behind the attack.

1995 — Vladmir Levin — Russian software engineer Vladimir Levin hacks into Citibank’s New York IT system from his apartment in Saint Petersburg and authorizes a series of fraudulent transactions, eventually wiring an estimated $10 million to accounts worldwide.

1998–2007 — Max Butler — Max Butler hacks U.S. government websites in 1998 and is sentenced to 18 months in prison in 2001. After being released in 2003, he uses WiFi to commit attacks, program malware and steal credit card information. In 2007, he is arrested and eventually pleads guilty to wire fraud, stealing millions of credit card numbers and around $86 million of fraudulent purchases.

1999 — NASA and Defense Department Hack — Jonathan James, 15, manages to penetrate U.S. Department of Defense division computers and install a backdoor on its servers, allowing him to intercept thousands of internal emails from different government organizations, including ones containing usernames and passwords for various military computers. Using the info, he steals a piece of NASA software. Systems are shut down for three weeks.

1999 — The Melissa Virus — A virus infects Microsoft Word documents, automatically disseminating itself as an attachment via email. It mails out to the first 50 names listed in an infected computer’s Outlook email address box. The creator, David Smith, says he didn’t intend for the virus, which caused $80 million in damages, to harm computers. He is arrested and sentenced to 20 months in prison.

2000 — Lou Cipher — Barry Schlossberg, aka Lou Cipher, successfully extorts $1.4 million from CD Universe for services rendered in attempting to catch the Russian hacker.

2000 — Mafiaboy — 15-year-old Michael Calce, aka MafiaBoy, a Canadian high school student, unleashes a DDoS attack on several high-profile commercial websites including Amazon, CNN, eBay and Yahoo! An industry expert estimates the attacks resulted in $1.2 billion dollars in damages.

2002 — Internet Attack — By targeting the thirteen Domain Name System (DNS) root servers, a DDoS attack assaults the entire Internet for an hour. Most users are unaffected.

2003 — Operation CyberSweep — The U.S. Justice Department announces more than 70 indictments and 125 convictions or arrests for phishing, hacking, spamming and other Internet fraud as part of Operation CyberSweep.

2003–2008 — Albert Gonzalez — Albert Gonzales is arrested in 2003 for being part of ShadowCrew, a group that stole and then sold card numbers online, and works with authorities in exchange for his freedom. Gonzales is later involved in a string of hacking crimes, again stealing credit and debit card details, from around 2006 until he is arresting in 2008. He stole millions of dollars, targeted companies including TJX, Heartland Payment Systems and Citibank.

2004 — Lowe’s — Brian Salcedo is sentenced to 9 years for hacking into Lowe’s home improvement stores and attempting to steal customer credit card information.

2004 — ChoicePoint — A 41-year-old Nigerian citizen compromises customer data of ChoicePoint, but the company only informs 35,000 people of the breach. Media scrutiny eventually leads the consumer data broker, which has since been purchased by LexisNexis, to reveal another 128,000 people had information compromised.

2005 — PhoneBusters — PhoneBusters reports 11K+ identity theft complaints in Canada, and total losses of $8.5M, making this the fastest growing form of consumer fraud in North America.

2005 — Polo Ralph Lauren/HSBC — HSBC Bank sends letters to more than 180,000 credit card customers, warning that their card information may have been stolen during a security breach at a U.S. retailer (Polo Ralph Lauren). A DSW data breach also exposes transaction information from 1.4 million credit cards.

2006 — TJX — A cybercriminal gang steals 45 million credit and debit card numbers from TJX, a Massachusetts-based retailing company, and uses a number of the stolen cards to fund an electronic shopping spree at Wal-Mart. While initial estimates of damages came up to around $25 million, later reports add up the total cost of damages to over $250 million.

2008 — Heartland Payment Systems — 134 million credit cards are exposed through SQL injection to install spyware on Heartland’s data systems. A federal grand jury indicts Albert Gonzalez and two Russian accomplices in 2009. Gonzalez, alleged to have masterminded the international operation that stole the credit and debit cards, is later sentenced to 20 years in federal prison.

2008 — The Church of Scientology — A hacker group known as Anonymous targets the Church of Scientology website. The DDoS attack is part of a political activist movement against the church called “Project Chanology.” In one week, the Scientology website is hit with 500 DDoS attacks.

2010 — The Stuxnet Worm — A malicious computer virus called the world’s first digital weapon is able to target control systems used to monitor industrial facilities. It is discovered in nuclear power plants in Iran, where it knocks out approximately one-fifth of the enrichment centrifuges used in the country’s nuclear program.

2010 — Zeus Trojan Virus — An Eastern European cybercrime ring steals $70 million from U.S. banks using the Zeus Trojan virus to crack open bank accounts and divert money to Eastern Europe. Dozens of individuals are charged.

2011 — Sony Pictures — A hack of Sony’s data storage exposes the records of over 100 million customers using their PlayStation’s online services. Hackers gain access to all the credit card information of users. The breach costs Sony more than $171 million.

2011 — Epsilon — A cyberattack on Epsilon, which provides email-handling and marketing services to clients including Best Buy and JPMorgan Chase, results in the compromise of millions of email addresses.

2011 — RSA SAFETY — Sophisticated hackers steal information about RSA’s SecurID authentication tokens, used by millions of people, including government and bank employees. This puts customers relying on them to secure their networks at risk.

2011 — ESTsoft — Hackers expose the personal information of 35 million South Koreans. Attackers with Chinese IP addresses accomplish this by uploading malware to a server used to update ESTsoft’s ALZip compression application and steal the names, user IDs, hashed passwords, birthdates, genders, telephone numbers, and street and email addresses contained in a database connected to the same network.

2011–2012 — LulzSec — Lulz Security, or LulzSec, a break-off group from hacking collective Anonymous, attacks and then targets more than 250 public and private entities, including an attack on Sony’s PlayStation Network. They then publicize their hacks though Twitter to embarrass website owners and make fun of insufficient security measures.

2009–2013 — Roman Seleznev — Roman Seleznev hacks into more than 500 businesses and 3,700 financial institutions in the U.S., stealing card details and selling them online, making tens of millions of dollars. He is eventually caught and convicted for 38 charges, including hacking and wire fraud.

2013–2015 — Global Bank Hack — A group of Russian-based hackers gains access to secure information from more than 100 institutions around the world. The hackers use malware to infiltrate banks’ computer systems and gather personal data, stealing £650 million from global banks.

2013 — Credit Card Fraud Spree — In the biggest cybercrime case filed in U.S. history, Federal prosecutors charge 5 men responsible for a hacking and credit card fraud spree that cost companies more $300 million.

2014–2018 — Marriott International — A breach occurs on systems supporting Starwood hotel brands beginning in 2014. Attackers remain in the system after Marriott acquires Starwood in 2016 and aren’t discovered until September 2018. The thieves steal data on approximately 500 million customers. Marriott announces it in late 2018.

2014 — eBay — A cyberattack exposes names, addresses, dates of birth, and encrypted passwords of all of eBay’s 145 million users.

2014 — CryptoWall — CryptoWall ransomware, the predecessor of CryptoDefense, is heavily distributed, producing an estimated revenue of $325 million.

2014 — JPMorgan — Hackers hijack one of JPMorgan Chase’s servers and steal data about millions of bank accounts, which they use in fraud schemes yielding close to $100 million.

2015 — Anthem — Anthem reports theft of personal information on up to 78.8 million current and former customers.

2015 — LockerPin — LockerPin resets the pin code on Android phones and demands $500 from victims to unlock the device.

2015 — Prepaid Debit Cards — A worldwide gang of criminals steals a total of $45 million in a matter of hours by hacking a database of prepaid debit cards and then draining cash machines around the globe.

2016 — DNC Email Leaks — Democratic National Committee emails are leaked to and published by WikiLeaks prior to the 2016 U.S. presidential election.

2017 — Equifax — Equifax, one of the largest U.S. credit bureaus, is hacked, exposing 143 million user accounts. The sensitive leaked data includes Social Security numbers, birth dates, addresses, driver’s license numbers, and some credit card numbers.

2017 — Chipotle — An Eastern European criminal gang that is targeting restaurants uses phishing to steal credit card information of millions of Chipotle customers.

2017 — WannaCry — WannaCry, the first known example of ransomware operating via a worm (viral software that replicates and distributes itself), targets a vulnerability in older versions of Windows OS. Within days, tens of thousands of businesses and organizations across 150 countries are locked out of their own systems by WannaCry’s encryption. The attackers demand $300 per computer to unlock the code.

2019 — Facebook — 74 Facebook groups devoted to the sale of stolen credit card data, identity info, spam lists, hacking tools, and other cybercrime commodities are uncovered.

Let these examples be a reminder to us all — history needs to stop repeating itself!

Cryptojacking in 2019 is not dead — it’s evolving!

Cryptojackers have shut down university networks and government websites, but there was one case that attracted a lot of attention, and that is the use of Coinhive mining service focused on mining Monero.

With the closure of Coinhive it appeared that cryptojacking might be coming to an end. Coinhive was a cryptocurrency mining service that relied on a small chunk of computer code installed on websites. It released its mining code in 2017, pitching it as a way for website owners to earn an income without running intrusive or annoying advertisements. However, although Coinhive was not an inherently malicious code, it became popular among hackers for cryptojacking. The more people visited a site, the more processing power was siphoned off to mine Monero.

Coinhive malware

The platform had seemed like a good idea until the software went on to form the foundation of the notorious cryptojacking malware that ended up affecting millions of user devices, spiking electricity bills, and draining batteries to secretly and illicitly mine cryptocurrency, as Conor Maloneywrites for CCN. Furthermore, as more and more criminals hacked sites and planted the Coinhive file, the issue shot completely out of control. Maloney writes: “Coinhive was listed as the world’s greatest online malware threat by cybersecurity firm Check Point for 15 consecutive months, and an estimated 5% of all Monero was mined through cryptojacking.”

Coinhive announced that it would be shutting down operations on 8th March 2019, and many thought that would be the end of intensive cryptojacking activity. However, Maloney points out that while the cryptojackers can’t turn to Coinhive anymore, they will look for other means of attack.

The Coinhive vacuum is waiting to be filled

Chris Dawson, Threat Intelligence Lead at Proofpoint, a security company, commented that Coinhive was far from the only cryptojacking malware on the market, adding “the fall of Coinhive leaves a power vacuum waiting to be filled,” as he told Maloney. Dawson sees a thrat coming from other forms of malware, such as “banking trojans, credential stealers and pieces of malware which sit on machines.”

Others, such as Jerome Segura of Malwarebytes, believe the criminal industry is slowing down. He told ZDNet the criminal industry is slowing down: “There are still a lot of hacked sites with Coinhive code, but I have a feeling these are mostly remnants from past hacks. Most of what I see these days is CoinIMP [a Coinhive competitor] and it’s been active again with Drupal hacks recently. But overall, I think the trend is nearing out.”

Is Segura too optimistic? Ransomeware like WannaCry and Petya have dealt catastrophic blows, taking down services at hospitals, car factories, government facilities, and airports as well as infecting personal devices to extract a ransom that is usually payable in Bitcoin. And cryptojacking malware still exists — Cryptoloot being one example, the second most lethal after Coinhive. There is also Emotet, a banking Trojan, which can infect a computer as a malicious attachment and be used to spread other forms of malicious software, plus a host of password-collecting bots.

It may be good news that Coinhive has closed down, but we cannot be complacent and believe the threat of cryptojacking has gone away. As long as there is cryptocurrency for the taking, cryptojackers will be evolving their tactics for getting their hands on it, and we need to be more vigilant than ever.

The Malware Hunter

Avoiding malware, which can invade your computer via phishing emails or malicious sites, is a common preoccupation. You only have to click on the wrong thing and you’ve caught a ‘botnet’ that may attack your business website or spread a virus.

But, now it looks like help is on the way, albeit in a rather unusual, roundabout way. Netlab 360 has identified a type of botnet that can search for specific malware infections without harming your computer. What is more, once it has hunted down and eliminated the ‘bad botnet’, it deletes itself from your computer.

Netlab 360 engineer, Hui Wang, has called it ‘Fbot’, although nobody knows who created it, which is one of the interesting parts of this story. But, whoever is responsible for it, has basically designed a bot that does a much-needed job.

The way it works is like this, according to Jon Christian writing in “Fbot first infects computers that leave a specific port vulnerable to attack. Then it searches its new hosts for a piece of malware called com.ufo.miner, which uses infected computers to mine the cryptocurrency Monero — and eradicates it.”

Wang says, “So far, the only purpose of this botnet looks to be just going after and removing another botnet.” Other unusual aspects of the bot are:

· The bot does not use traditional DNS to communicate with the C2, instead, it utilises blockchain DNS to resolve the non-stand C2 name musl.lib.

· It appears to have strong links to the original satori botnet.

Coindesk has also commented on the new discovery, saying “Unusually, the botnet code is linked to a domain name accessible, not through a standard domain name system (DNS), but a decentralized alternative called EmerDNS that makes addresses harder to trace and shut down.”

And researchers also pointed out: “The choice of Fbot using EmerDNS other than traditional DNS is pretty interesting, it raised the bar for security researcher to find and track the botnet (security systems will fail if they only look for traditional DNS names).”

Either way, everyone is extremely curious about who is behind the botnet — is it somebody working with good intentions, or is it a hacker trying to remove the competition. Perhaps we will never know.